Right to Delete Personal Information

00:01

Hello, everyone and welcome Toe Lesson 3.4 as we discussed the next consumer right that exists under the C C. P. A.

00:08

The right to delete personal information,

00:12

the learning goals and objectives for less than 3.4.

00:16

First, we will review the concept of a deletion request.

00:20

What does that mean?

00:21

Goal number two.

00:22

We will review the major exceptions to a consumer's request to delete personal information.

00:28

I need to warn you ahead of time.

00:29

The exceptions under the CCP A are far greater than the GDP are or any other privacy law. To my knowledge, that exists out there.

00:37

The C C P. A. Has a lot of exceptions. We will explore them,

00:42

then number three, then meat and potatoes of less than 3.4.

00:45

We will actually review how toe execute internally. A deletion request.

00:51

The baseline rule that you need to be aware of is that the CCP A provides consumers with the right to request that a business delete any personal information about that consumer.

01:00

This was one of the main reasons by the CCP even came into existence.

01:06

The advocates, including Alastair McTaggart and Mary Stone Ross and others

01:10

We're very concerned that companies were keeping personal information about consumers into perpetuity and that there was no mechanism to delete personal information after it was collected.

01:21

This right here is one of the main reasons why the CCP a even exists in the first place.

01:26

Now there are some exceptions to this golden rule, but the burden needs to be established by the business I, your employer, that an exception to a deletion request even exists in the first place.

01:38

If you ever received a deletion request at work, my recommendation to you is to take out a piece of paper right on that note with the words, Yes,

01:48

there needs to be really good reason for, you know, later in time, rip that paper in half because the burden truly does fall on your company to establish that a delicious exception exists.

01:59

Now,

02:00

assuming it does,

02:00

let's jump into it.

02:05

There are seven major exceptions to a deletion request

02:08

in the e commerce space. I'm starting at the top of the screen.

02:13

In order to fulfill a transaction, companies generally need to hold on to the personal information of consumers, things like shipping credit card information. Sometimes they need to hold on to previous purchase history just in order to fulfill the request.

02:29

The Legislature understood that at the time the law was passed. And for that reason, fulfilling a transaction is one of the reasons why a company can refuse to delete consumer information.

02:42

For those of you who work in the information security space, the next three items on the right side of your screen, protecting against malicious activity, detecting security incidents or even performing system maintenance and debugging

02:53

Those are all reasons why you can refuse to delete consumer information.

02:59

The Legislature again understood that it was difficult to protect a network if at times you must delete log information or other types of personal information that might help you in addressing some sort of security incident.

03:13

That is a major exception to keep an eye on. And if you work in I T. That's going to be up to you to raise your hand and say

03:20

hi.

03:21

I believe that a deletion exception might apply here

03:24

on the left side of your screen. These scenarios are ah, a little less likely, but if you happen to work in the media space, the CCP, a does create a deletion exception

03:34

if individuals are in the process of exercising their free speech.

03:38

Basically, the idea here is that the Internet today is the primary form upon which individuals discuss in political conversations.

03:46

And if consumers were able to delete pieces of information, then that would greatly endanger the ability for the First Amendment to work efficiently.

03:53

That's why that exception exists

03:58

legal obligations and warrants.

04:00

Nine times out of 10. That's going to be your legal department, simply sending you a quick memo or an email saying, Here are the individuals of whom you cannot delete their personal information. It's called a legal hold.

04:13

You'll likely just get a notice via email or something like that.

04:16

This one is actually very hot right now.

04:18

Peer reviewed scientific research

04:21

say, for instance, you were to volunteer to be a member of the clinical trials that are taking place to help develop a vaccine for Cove in 19.

04:30

You cannot later in time request that your personal information be deleted.

04:34

Why?

04:36

Because that would throw off the results of the scientific research that's taking place.

04:41

Those seven deletion exceptions on paper. You need to keep an eye on

04:46

However,

04:46

there are two additional exception requests that you can also use if needed.

04:51

Let's start on the left side of the screen.

04:54

You can also refuse to delete consumer information if the internal use is reasonably aligned with the expectation of the consumer based upon the relationship that the consumer has with the business,

05:04

let me pause there and actually jump quickly over to the right side. And then I'll explain both at the same time.

05:12

Your business. Your company can also use personal information internally in a lawful manner that's compatible with the context in which the consumer provided the information in the first place.

05:24

This is very troublesome for a lot of privacy advocates.

05:28

In fact, at the time that the C C. P. A. Was being negotiated in Sacramento, one of the Legislature's screamed out loud The quote I have here,

05:35

you could drive a train through that, and it's true. This is a major exception.

05:43

Long story short. If you are using personal information in a way that the consumer could expect you to use that information,

05:49

then okay, you can actually refuse to delete the personal information.

05:55

If you are using that information to conduct high level marketing to establish a Siris of inferences based on consumer behavior,

06:00

things like that

06:02

that normally is not reasonably aligned with the consumer's expectations,

06:06

and you would be advised against using this expectation.

06:10

By the way, that's a good point. I would strongly recommend you seek outside assistance before deciding that one of these exceptions applies.

06:18

Those are the delusion Exceptions

06:23

Now let me quickly discuss an important piece of this year.

06:27

Deletion requests need to be pushed down to your third party,

06:30

all your service providers as well as any other company that your organization is aligned with,

06:35

so it could be a joint venture. It could be a parent company where there's other sister companies that all work together and maybe used this same server or same infrastructure on the back end. They also need to receive the deletion request as well.

06:48

They might not get it Initially,

06:50

it is up to you to push that down and share that information is going to be deleted.

06:58

If you only delete personal information that is housed on your network, you are not fulfilling a deletion request.

07:03

You do need to go into salesforce and delete it you do need to go into your cloud environment and delete it.

07:10

I recommend you double check what's called your data processing agreements. DPS

07:15

Normally, that's driven by a privacy office or legal department. But service providers are familiar with these requests, and they should be deleting them, deleting the personal information when they receive a request,

07:27

keep an eye on your DPS and ensure that third parties are in fact receiving a request for information to be deleted.

07:34

In summary, we've discussed the definition of a deletion request.

07:39

It's different than the right to be for gotten or the right to a razor that exists under the GDP are.

07:44

Why is that?

07:46

Because of all the deletion exceptions, there are farm or than the GDP are, and we will discuss some more of that in module nine.

07:53

We also discussed the importance of pushing down deletion requests to your service providers and any other joint ventures or other sister companies that use the same infrastructure on the back end

08:03

that catches everything for less than 3.4.

08:07

I will see you in the next lesson.